Stable Multi Agent v2 and the Cost of Encryption

Ethan Park

So, Maya, I was looking through the changelog for the new Codex CLI v0.145.0 release, and they have officially marked Multi Agent v2 as stable. But, uh, there is a massive catch here that is going to drive developers crazy. When a parent agent talks to a child agent, those instructions are now fully encrypted. Like, completely black boxed on your local machine.

Maya

Wait, what? It is running locally on my machine, but I cannot see what the agents are saying to each other? How does that work?

Ethan Park

Exactly. If you dig into PR 33509 and PR 34383, the flow has completely changed. When a parent agent spawns a sub agent, OpenAI's Responses API encrypts the message payload. The locally running Codex CLI, it just receives and forwards raw ciphertext. It literally carries that same ciphertext without being able to decrypt it. Decryption only happens once it gets back to OpenAI's servers, right before they hand it off to the child model.

Maya

So the local CLI is just acting like a blind courier. It is passing a locked briefcase it does not have the key to. But, wait, what about debugging? If I am running a local SQLite database to track state, like we talked about in the last episode, what actually gets written to the disk now?

Ethan Park

Oh, it is a mess for debugging. Under PR 33030 and PR 33841, the local InterAgentCommunication table in SQLite literally writes the plaintext content field as an empty string. All the actual instructions, the prompts, the routing, they are stuffed into the encrypted_content column. And it gets worse. The list_agents command? They stripped the task text from it. It only returns the name and the status indicators now. No text.

Maya

That is incredibly frustrating. If a sub agent spins out of control and, I don't know, runs a destructive tool like deleting a database, you cannot even look at the local history to see *why* it did that? You cannot see the prompt that triggered it?

Ethan Park

Nope. You are completely blind in your own local logs. And, uh, if you are wondering why they did this, it is not just some random security hardening. It is actually a direct move to stop API piracy.

Maya

Piracy? How do you pirate an agent workflow?

Ethan Park

Well, there are these unauthorized, low cost Codex API resellers, especially active in some markets, that were hijacking these agent workflows. They would intercept the parent agent's message to the child agent, grab the reasoning, and then replay or route those sub agent tasks to cheaper downstream accounts under different keys. By encrypting the parent to child communication, OpenAI ties the cryptographic state directly to the upstream session credentials. If you do not have the original session's OAuth handshake, you cannot decrypt or reuse those instructions.

Maya

Huh. So they secured the business model, but they completely broke local auditability to do it. Thanks to Jellypod to help make this daily show a reality, because we are going to need to unpack how developers are supposed to actually work with this.

Maya

Okay, so if we cannot see the messages, how does this actually feel to use in the terminal? Like, if I am using the TUI, the terminal user interface, what happens when a sub agent is running?

Ethan Park

Well, under PR 33841, those parent owned sub agent threads are now strictly read only in the TUI. You can watch them run, but you cannot touch them. If a sub agent gets stuck in a runaway loop, or starts deviating from the task, you cannot jump in and type a correction or override the prompt. Your only option is to abort the entire task.

Maya

Man, that is a huge step back for developer experience. I used to love nudging agents back on track. And what about resuming sessions? If I am working on a laptop, and then I push my state to a remote server or a different machine, does that break the encryption?

Ethan Park

It absolutely does if you are not careful. Under PR 32229, the local OAuth credentials are managed by a highly specific serialized storage system. If you try to resume a multi agent thread on a different machine, or even through a different proxy configuration, and those credentials do not match perfectly, the session validation fails. You get decryption errors, and the whole thing just grinds to a halt.

Maya

Okay, so it is super rigid. But, to be fair, they did ship *some* quality of life updates in 0.145.0 to ease the pain, right?

Ethan Park

Yeah, they did. They are trying to give us some sugar to help the medicine go down. For instance, PR 33950 finally lets the CLI persist and remember your exact working directory, the cwd, when you resume a thread. That means no more local file system state drift where the agent thinks it is in one folder, but your terminal is in another.

Maya

Okay, that is actually really helpful. And didn't they add something for people migrating from other tools?

Ethan Park

Yes! PR 33426 adds the import command, which automates settings migration from Cursor. So if you are moving your setup over, it pulls your config cleanly. Oh, and they also bumped the packaged ripgrep to version 15.2.0 in PR 34384, which speeds up local file searches during agent context building.

Maya

Fine, faster search is nice, but it does not solve the big observability problem. Is the community just accepting this empty plaintext field in SQLite?

Ethan Park

Definitely not. There is a very active debate on GitHub right now, specifically Issue 28058. Enterprise developers are pushing OpenAI to introduce a separate, unencrypted audit field in the local SQLite tables. The idea is to let the local CLI log a high level summary of the delegation, without compromising the secure, encrypted upstream transport path. But so far, OpenAI hasn't committed to it.

Maya

Yeah, because why make it easy to debug when you can make it secure, right? Alright, well, that is v0.145.0 for you. Secure, stable, and completely opaque. Catch you next time.

Ethan Park

Talk soon.